4533e1a7b5b107b7c94dd84fafeb0b438e11b694efba13261e1e42b0a61ade2d

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe
Size

382KB
MD5

820bedcf090e724f9297540ce1b608a4
SHA1

99410615972be24185e9d8a70cf31cf635e930b3
SHA256

4533e1a7b5b107b7c94dd84fafeb0b438e11b694efba13261e1e42b0a61ade2d
SHA512

2d072dcc3780b17b327639a52e01bb501fe9432f76c62002a36e24618893973bcf6cc6a537f3f697692aeca2d869c8057bf5ae546dceb284d6d3a3b36eb0c621
SSDEEP

6144:s9YglkBkfSOBlWWRmGwL4QQgKKX8x7/2xWqWma2XDzHPt281:s9YgGpOjWtGNgDUiWqWNKDrt2

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\agapgj\Parameters\ServiceDll = "%SystemRoot%\\System32\\agapgj.dll"	1.exe

Executes dropped EXE 1 IoCs

pid	Process
1772	1.exe

Loads dropped DLL 2 IoCs

pid	Process
1772	1.exe
4168	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\agapgj.dll	1.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1772	1.exe
1772	1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1772	3900	820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe	85
PID 3900 wrote to memory of 1772	3900	820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe	85
PID 3900 wrote to memory of 1772	3900	820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\820bedcf090e724f9297540ce1b608a4_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k agapgj
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe

Filesize
24KB

MD5
21b8866c9500bfc9f310d641e396d373

SHA1
6177aa244b4cd1c68c259f0f1bb876f0f03fe408

SHA256
f65b6f3557c68b4389fed24ef09ed6f285eef053fd77e97abc2454ea5ec78e2d

SHA512
71f80ef283d4d02a0084f24fbc5a1b996068745770fbcd7a560621831dcdd918c79ee576fd28d0b7cdcc62b4d22f0288d3fb78214cd4a2bea36f164799784278

Download Submit
C:\Windows\SysWOW64\agapgj.dll

Filesize
17KB

MD5
3ce3937c22d638b7c15c30d644a33daf

SHA1
9e66be96c83ac23f5ebd2053be1f17f5c7b6274f

SHA256
180cf3934305c22967bd8fa14f55543a51c90bcfbd3e8e87d05e6ad3ac7949df

SHA512
f97600a9a0ff1ec0b235ce0244cf40c4053b1a1cb2b8a14b73f2385b8b0b6d261a3e1e523535e1941a070059a25c269925de8f49f20318f975b3d4b15976141a

Download Submit
memory/3900-0-0x0000000001000000-0x000000000115D000-memory.dmp

Filesize
1.4MB

Download
memory/3900-2-0x0000000001000000-0x000000000115D000-memory.dmp

Filesize
1.4MB

Download
memory/3900-17-0x0000000001000000-0x000000000115D000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads